fix(javascript): mask API key in ApiError stack trace (generated)

algolia/api-clients-automation#7182

Co-authored-by: Brennan Blair <36816721+bblair31@users.noreply.github.com>

Author: algolia-api-clients-automation-bot[bot]

packages/client-common/src/__tests__/transporter/correlationId.test.ts

@@ -81,6 +81,29 @@ describe('correlation ID on errors', () => {
     expect(error.message).toBe('Invalid API key');
   });
 
+  test('masks the API key in every stack frame of 4xx errors', async () => {
+    let attempt = 0;
+    const transporter = createTestTransporter(
+      {
+        send: async () => {
+          attempt++;
+          return attempt === 1
+            ? { status: 500, content: '', isTimedOut: false }
+            : { status: 403, content: JSON.stringify({ message: 'Invalid API key', status: 403 }), isTimedOut: false };
+        },
+      },
+      2,
+    );
+
+    const error: ApiError = await transporter.request({ ...request, headers: { 'x-algolia-api-key': 'secret' } }).then(
+      () => Promise.reject(new Error('should have thrown')),
+      (err) => err,
+    );
+
+    expect(error).toBeInstanceOf(ApiError);
+    expect(error.stackTrace.map((frame) => frame.request.headers['x-algolia-api-key'])).toEqual(['*****', '*****']);
+  });
+
   test('reads the header case-insensitively from custom requesters', async () => {
     const transporter = createTestTransporter({
       send: async () => ({

packages/client-common/src/transporter/createTransporter.ts

@@ -270,7 +270,7 @@ export function createTransporter({
       }
 
       pushToStackTrace(response);
-      throw deserializeFailure(response, stackTrace);
+      throw deserializeFailure(response, stackTraceWithoutCredentials(stackTrace));
     };
 
     /**